update package.json, update permissions